{"id":"CVE-2021-21241","aliases":["DEBIAN-CVE-2021-21241","EUVD-2021-0087","GHSA-hh7m-rx4f-4vpv","PYSEC-2021-91","SUSE-SU-2022:3093-1","openSUSE-SU-2024:13561-1","openSUSE-SU-2024:14555-1"],"status":"published","title":"CSRF can expose users authentication token in Flask-Security-Too","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00928,"percentile":0.60787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2021-01-11T20:35:16Z","modified":"2026-10-23T18:03:29Z","fixes":[{"ecosystem":"PyPI","package":"flask-security-too","fixed_in":["3.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"flask-security","fixed_in":["4.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flask-security","fixed_in":["4.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flask-security","fixed_in":["4.0.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask-security-too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-security-too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.5"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"]},{"source":"osv","ecosystem":"PyPI","package":"flask-security-too","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"61d313150b5f620d0b800896c4f2199005e84b1f"},{"fixed":"6d50ee9169acf813257c37b75babe9c28e83542a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.5"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Flask-Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"flask-middleware","product":"flask-security-too"},{"vendor":"flask-security-too_project","product":"flask-security-too"}],"references":[{"url":"https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/Flask-Middleware/flask-security/pull/422","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://pypi.org/project/Flask-Security-Too","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21241","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2021-91.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20210118165844/https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5","tags":["web"]},{"url":"https://web.archive.org/web/20210118165958/https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a","tags":["web"]},{"url":"https://web.archive.org/web/20210118170445/https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f","tags":["web"]},{"url":"https://web.archive.org/web/20211207005640/https://github.com/Flask-Middleware/flask-security/pull/422","tags":["web"]},{"url":"https://web.archive.org/web/20210118170502/https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hh7m-rx4f-4vpv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21241","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223093-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181058","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21241","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49438","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-21241","title":"CSRF can expose users authentication token in Flask-Security-Too","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T20:35:16Z","modified":"2024-08-03T18:09:15.009Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-0087","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T20:35:16Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"ghsa":[{"id":"GHSA-hh7m-rx4f-4vpv","title":"CSRF can expose users authentication token","description":"### Issue\nThe  /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.\n\n### Patches\nVersion 3.4.5 and soon to be released 4.0.0 are patched.\n\n### Workarounds\nIf you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.\n\n### References\nNone","status":"published","published":"2021-01-11T20:38:28Z","modified":"2024-09-20T17:48:14Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-21241","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T21:15:13.377Z","modified":"2026-06-17T03:35:06.603Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-21241","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T21:15:13.377Z","modified":"2026-03-15T22:38:58.440232Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21241","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T21:15:13.377Z","modified":"2026-10-23T18:03:29.349232813Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-hh7m-rx4f-4vpv","title":"CSRF can expose users authentication token","description":"### Issue\nThe  /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.\n\n### Patches\nVersion 3.4.5 and soon to be released 4.0.0 are patched.\n\n### Workarounds\nIf you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.\n\n### References\nNone","status":"published","published":"2021-01-11T20:38:28Z","modified":"2026-03-13T22:16:07.77432Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"openSUSE-SU-2024:13561-1","title":"python310-Flask-Security-Too-5.3.2-3.1 on GA media","description":"These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:13.02334Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14555-1","title":"python310-Flask-Security-5.5.2-1.1 on GA media","description":"These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-06T00:00:00Z","modified":"2026-02-04T04:31:47.3458Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"PYSEC-2021-91","description":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.","status":"published","published":"2021-01-11T21:15:00Z","modified":"2023-11-08T04:04:39.251638Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:3093-1","title":"Security update for python-Flask-Security-Too","description":"This update for python-Flask-Security-Too fixes the following issues:\n\n- CVE-2021-21241: Fixed an issue where GET requests lacking CSRF\n  protection to certain endpoints could return the user's\n  authentication token (bsc#1181058).\n","status":"published","published":"2022-09-06T05:52:18Z","modified":"2026-02-04T03:43:53.426208Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}